Executive brief
The OpenZeppelin Contracts Wizard is a tool that generates smart contract code and test files for developers. When developers use the tool with specially crafted input names or URIs, malicious code can be injected into the generated test files. Running these tests (via npm test or forge test) would execute the attacker's code, potentially compromising the developer's environment and allowing theft of credentials, private keys, or other sensitive data.
Technical details
This is a code injection vulnerability (CWE-94) in the @openzeppelin/wizard package. The zipHardhat and zipFoundry functions generate test files by directly interpolating unsanitized user input (opts.name and opts.uri) into TypeScript (test/test.ts) and Solidity (test/*.t.sol) source code respectively. An attacker can craft input containing escape sequences and arbitrary code that breaks out of the surrounding string literal and is parsed as valid code. The attack requires user interaction—a developer must download the generated project and execute npm test or forge test—but no authentication or special privileges are needed. Successful exploitation results in arbitrary code execution in the developer's local environment with the privileges of the user running the test command. The vulnerability is fixed in @openzeppelin/wizard@0.10.9 by properly escaping the user-supplied input before code generation.
Affected products
- OpenZeppelin @openzeppelin/wizard <= 0.10.8
Timeline
- 2026-05-20: disclosed: Advisory published by OpenZeppelin
- 2026-05-20: patched: Fixed in @openzeppelin/wizard@0.10.9
References
- https://github.com/OpenZeppelin/contracts-wizard/security/advisories/GHSA-4x76-22x2-rx8v
- https://github.com/OpenZeppelin/contracts-wizard/commit/ec12c44f8d9e0491eba31037f95b36e98ec58b5f
- https://github.com/OpenZeppelin/contracts-wizard
- https://github.com/OpenZeppelin/contracts-wizard/releases/tag/%40openzeppelin%2Fwizard%400.10.9